Once authenticated and at the "top-level" of the application, pressing back should back out of the app. Doing anything other than that would be strange.
I wouldn't logout a User for simply backing out of the app, that is effectively punishing the user. That would also make it ambiguous as to the authenticated state when backgrounding the app.
In terms of biometric authentication, you may be better off requiring that at the OS level and with a lockscreen - i.e. your app requires a certain level of security controls to be in use by the OS in order to be used, rather than the app itself requiring such hurdles just to enter the app. After all, mobile phones are personal devices and sessions plus logout were really invented for non-personal desktop computer scenarios (kiosks, Internet Cafes) and insecure communication channels. These decisions do depend on the risks associated with your app and business of course.